Skip to contentVulnerabilities with public exploits
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)CVE-2026-77262Public exploitFix available8.6 High
- netdataNetdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCECVE-2026-83603Public exploit8.4 High
- wordpress core, wordpress +1 moreWordPress Core Remote File Inclusion VulnerabilityCVE-2026-87902In KEVPublic exploitFix availableEPSS 95.8%8.1 High
- f5 big-ip, big-ip apm, big-ip access policy manager +2 moreBIG-IP APM OAuth vulnerabilityCVE-2026-94127In KEVPublic exploitEPSS 26.6%9.3 Critical
- d-link dap-1360D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management InterfaceCVE-2026-95675Public exploit9.3 Critical
- check point multiple products, checkpoint multi-domain security management, quantum security management +2 moreDirectory Traversal and File upload allows execution of arbitrary script on the Management ServerCVE-2026-93616In KEVPublic exploitEPSS 91.6%9.8 Critical
- apache software foundation tomcatApache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upCVE-2026-86350Public exploitFix available9.1 Critical
- apache software foundation tomcatApache Tomcat: Bypass of security constraints for WebSocket endpointsCVE-2026-76183Public exploitFix available9.8 Critical
- qualcomm mdm9207 firmware, mdm9645 firmware, mdm9655 firmware +6 more +8 moreWrite-what-where Condition in Primary BootloaderCVE-2026-25262Public exploit6.9 Medium
- liquidweb give tributesGive Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' ParameterCVE-2026-19658Public exploit9.8 Critical
- meta box frontend submissionMeta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' ParameterCVE-2026-13355Public exploit9.8 Critical
- 1panel-dev maxkbMaxKB: Prompt-injectable agent can lead to command executionCVE-2026-77521Public exploit10.0 Critical
- lucasdillmann nginx-ignitionnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionCVE-2026-61628Public exploitFix available8.1 High
- biostar valkyrie auroraBioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-whereCVE-2026-94129Public exploit9.3 Critical
- biostar vivid led djBioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-whereCVE-2026-94128Public exploit9.3 Critical
- netcore nbr200v2Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionCVE-2026-94095Public exploit9.4 Critical
- ordasoft.com ordasoft joomla gallery extension for joomla, ordasoft joomla gallery free extension for joomla +1 moreJoomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7CVE-2026-88854Public exploit9.3 Critical
- d-link dir-x1860, dir-x1860z +1 moreD-Link DIR-X1860/DIR-X1860Z routerd ubus access controlCVE-2026-94036Public exploit8.7 High
- vanderbilt redcapAn unauthenticated Remote Code Execution vulnerability was found in the survey passthrough...CVE-2026-90817Public exploit9.8 Critical
- zte smartlifeA vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPCVE-2026-86552Public exploit5.4 Medium
- d-link r95D-Link R95 DHMAPI ssi system os command injectionCVE-2026-93958Public exploit9.4 Critical
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershipCVE-2026-94000Public exploit6.6 Medium
- unknown wpgraphql smart cacheWPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias SquattingCVE-2026-92099Public exploit6.5 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment ContentCVE-2026-89274Public exploit9.1 Critical
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' ParameterCVE-2026-92229Public exploit9.1 Critical
- gravity forms formsGravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload FieldCVE-2026-84434Public exploit9.8 Critical
- teluu pjsip, pjsip pjproject +1 morePJSIP: Heap buffer overflow in the AVI parserCVE-2026-77396Public exploit6.9 Medium
- micromatch bracesbraces through 3.0.3 Stack Overflow via Deeply Nested PatternsCVE-2026-93687Public exploitFix available8.7 High
- concretecms-community-store community storeConcrete CMS Community Store before 2.7.8 Stored XSSCVE-2026-93659Public exploit8.6 High
- danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builderPopup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] ParameterCVE-2026-87915Public exploit7.2 High
- synology diskstation manager (dsm)An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager ...CVE-2026-13684Public exploit9.8 Critical
- apache software foundation airflowApache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)CVE-2026-75157Public exploitFix available7.5 High
- automattic wordpressWordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-93485Public exploitFix available7.1 High
- No product listedCross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote...CVE-2026-79294Public exploit6.1 Medium
- alinto sogoSOGo before 5.12.11 Password Reset Token Interception via Origin HeaderCVE-2026-93453Public exploitFix available8.7 High
- cubecart v6CubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassCVE-2026-54645Public exploit4.8 Medium
- cubecart v6CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message SystemCVE-2026-54644Public exploit6.1 Medium
- cubecart v6CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.phpCVE-2026-54647Public exploit7.2 High
- cubecart v6CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.phpCVE-2026-54646Public exploit7.2 High
- vmdeshpande ai-agent-automationAI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletionCVE-2026-54519Public exploit8.8 High
- vmdeshpande ai-agent-automationAI Agent Automation: Workflow file step path traversal allows read and write outside the expected directoryCVE-2026-54520Public exploit8.1 High
- itflow-org itflowITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires ParameterCVE-2026-54597Public exploit8.3 High
- itflow-org itflowITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database ExfiltrationCVE-2026-54596Public exploit8.1 High
- chamilo chamilo-lmsChamilo LMS CStudio upload flow allows unauthenticated remote code executionCVE-2026-45140Public exploitFix available9.8 Critical
- solarwinds access rights managerSolarWinds Access Rights Manager Unauthenticated Remote Code Execution VulnerabilityCVE-2026-28326Public exploit8.8 High
- asynchttpclient async-http-clientAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceCVE-2026-85721Public exploitFix available7.5 High
- cakephpCakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionCVE-2026-79752Public exploitFix available9.2 Critical
- patriksimek vm2vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingCVE-2026-92956Public exploitFix available10.0 Critical
- patriksimek vm2vm2 NodeVM Remote Code Execution via Array-Shaped RequireCVE-2026-92935Public exploitFix available9.5 Critical
- sh1zen multi uploader for gravity formsMulti Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File UploadCVE-2026-87796Public exploit9.8 Critical
- Show moreLoading…